gotp

README

gotp

A simple library to assist with the generation of time-based and HMAC-based one-time passcodes for two-factor authentication.

Documentation

Overview

Package gotp is a Go library implementing the RFC6238 time-based one-time password algorithm, and RFC4226 HMAC-based one-time password algorithm. RFC6238 is based off RFC4226, however it uses a counter step of increments of 30 seconds since 1970-01-01T00:00:00Z.

Index

• Variables
• type Token
  • func NewToken() (*Token, error)
  • func TokenFromBytes(seedBytes []byte) (*Token, error)
  • func (t *Token) GenerateOTP(counterBytes []byte) (string, error)
  • func (t *Token) GenerateTOTP(genTime int64) (string, error)
  • func (t *Token) VerifyChallenge(challenge string, drift bool) bool

Variables

var (
	// The step to use. RFC6238 dictates a step of 30 seconds, however some
	// implementations use alternative steps.
	StepSeconds = 30
	// SeedLength is the length of the HMAC secret, or seed.
	// Usually 10 or so.
	SeedLength int = 20
	// TokenLength is the length of the generated TOTP.
	// Usually 6, sometimes 8.
	TokenLength = 6
)

Types

type Token

type Token struct {
	Seed   []byte
	Base32 string
}

Token is the core one-time password struct. It is naive, and does not store information about its counter step to facilitate simple construction of time-based one-time password.

func NewToken

func NewToken() (*Token, error)

NewToken generates a new OTP token with a random seed.

func TokenFromBytes

func TokenFromBytes(seedBytes []byte) (*Token, error)

TokenFromBytes generates a new OTP from an existing seed.

func (*Token) GenerateOTP

func (t *Token) GenerateOTP(counterBytes []byte) (string, error)

GenerateOTP generates a single six-digit OTP based on the OTP's seed and the counter factor.

func (*Token) GenerateTOTP

func (t *Token) GenerateTOTP(genTime int64) (string, error)

GenerateTOTP generates an OTP value based on the `genTime` provided time.

func (*Token) VerifyChallenge

func (t *Token) VerifyChallenge(challenge string, drift bool) bool

VerifyChallenge verifies the `challenge` password. If `drift` is true, it will verify the challenge against a 90-second window of TOTP generation to protect against clock drift denial of service, through no fault of the user.